- Published on
Mystery $106 Million Crypto Theft Hits EU Entity Days After Binance Hack
- Authors
- Name
- DeepHorus
An unnamed European Union entity is suspected of losing more than $106 million from multiple centralized exchange accounts on Nov. 1, according to pseudonymous onchain investigator ZachXBT. The funds were withdrawn as USDC and USDT by what he called an “illicit actor.” The case marks another nine-figure theft days after the industry’s largest heist.
In a Monday Telegram post, ZachXBT said the attacker moved to obscure the funds within 24 hours. The actor swapped USDC for ETH, routed assets through instant exchanges including WellWallet and Kyrrex, and converted some to Monero via Wagyu. The thief also bridged assets across blockchains, and ZachXBT published 11 Ethereum addresses tied to the theft.
Such tactics complicate recovery. Instant exchanges enable rapid swaps with little identity verification, while Monero conceals sender, receiver and amount. Moving out of USDC and USDT matters because stablecoin issuers can freeze those tokens.
ZachXBT said the culprit remains unidentified but stated with “a high degree of confidence” that it is not North Korea’s Lazarus Group, citing multiple laundering indicators. He did not name the victim. That distinguishes the incident from the $6.4 billion Binance hack, which the FBI attributed to TraderTraitor, a North Korean hacking group.
In the Binance case, Tether froze stolen USDT on Ethereum in 37 minutes, and Circle froze all $823 million in stolen USDC, helping lock up about 44% of the haul, according to Elliptic. Lazarus launderers have since spread remaining funds across about 12,000 wallets. It is unclear whether any EU-case funds were frozen.
The incident adds to an unprecedented week for crypto security. Brazilian exchange Mercado Bitcoin halted withdrawals after a $40 million hack, and BTCPay Server told merchants to switch off servers amid hot wallet attack reports. The EU case remains under investigation, with no public victim identification or confirmed recovery outlook.
